Personal information must not be casually transferred overseas; legal conditions and thresholds apply

Sending information about users inside China to a machine abroad is called an export, and putting the server abroad counts the same. In general you have to pass a security assessment by the cyberspace authority, or get a certification, or sign a standard contract. If the running total for the year is under 100000 people and does not include sensitive information, all 3 of those are waived. You also have to tell the user who abroad receives it and what they will use it for, and get that person's separate consent.

Cost

No cost involved. The simplest solution is to keep user data within China. If transfer overseas is unavoidable, follow standard contracts or obtain proper certification.

Benefit

To lawfully provide personal information to overseas entities — whether to foreign companies or foreign servers — at least one of four conditions must be met: passing a security assessment by the Cyberspace Administration; obtaining personal information protection certification; signing a standard contract drafted by the Cyberspace Administration; or meeting other requirements set by laws or administrative regulations. Additionally, you must inform users of the overseas recipient’s name, contact details, processing purpose, methods, and types of data involved, and obtain their separate consent. Threshold limits apply based on cumulative user counts. For most businesses not classified as critical information infrastructure operators, the exemption threshold is “fewer than 100,000 personal records (excluding sensitive information) transferred overseas in a calendar year.” Below this threshold, no assessment, contract, or certification is required. Between 100,000 and 1,000,000 records, a standard contract or certification is mandatory. For over 1,000,000 records, or when sensitive information of more than 10,000 individuals is involved, a formal security assessment is required (effective nationwide since March 2024).

Notes

Hosting servers overseas does not equate to “data never leaving China.” If a user registers within China and their data is sent to foreign servers, this is still a cross-border transfer. Certain scenarios are exempt from assessment, certification, or standard contracts: cross-border shopping, shipping, or booking flights/hotels, provided these actions are necessary to fulfill a contract involving the user. Note also that user counts are calculated on a cumulative basis starting from January (1) 1 of each year, not as a rolling 12-month period.

Sources · 3

1. 全国人大常委会 (2021). 个人信息保护法（第三十八、三十九、四十条）. spp.gov.cn/spp/fl/202108/t20210820_527244.shtml
2. 国家互联网信息办公室 (2024). 促进和规范数据跨境流动规定（网信办令第 16 号，第三、四、五、七、八条）. gov.cn/gongbao/2024/issue_11366/202405/conten…
3. 国家互联网信息办公室 (2022). 数据出境安全评估办法（网信办令第 11 号，第四条）. cac.gov.cn/2022-07/07/c_1658811536396503.htm